Boot an encrypted disk image?

[Haole Boy]

Aloha everyone. I have a customer system where the motherboard has died. Kinda doubtful the customer will pay for a new MB, but I'd like to try and save his data. He's got an NVMe drive (that I assume is the Windows drive) plus a regular HDD, both are BitLocker encrypted. Here is what I would like to try, can anyone tell me if this is possible?

I'm waiting on an external enclosure for the NVMe drive so that I can create a disk image using Macrium. I then want to try booting from the image using Macrium viBoot. What I don't know in this scenario is if I will get prompted for the BitLocker recovery key. If so, then I do have the recovery key from the customer, so should I be able to boot this image? Of course this assumes that the Windows system in this image is not damaged.

And, if I am able to boot the image, how would I connect it to the HDD what has (I assume) some of his data on it? I haven't used Hiper-V much, so any pointers would be appreciated.

Mahalo,

Harry Z

 

[Moltuae]

How was the Macrium image created? If it's a backup that was performed from within Windows (ie while the system was running, before the motherboard died), then the image won't be encrypted. Have you tried mounting the image on another system?

 

[Haole Boy]

Mahalo for the reply. My plan is to create an image of the NVMe drive once the USB attach enclosure for the NVMe drive arrives next week, so the image will definitely be of the encrypted drive.

 

[labtech]

Don't create an image file. Create a clone to physical drive. Connect to Windows 10 and Bitlocker prompt will pop up asking for the recovery key. Recover files.

 

[Haole Boy]

Ah, you're suggesting I do this the easy way!

Following your suggestion I tried this with the HDD, but the recovery key sent by the customer was apparently the wrong one. I've asked him to see if he can find any other recovery keys for himself or his wife.

 

[Markverhyden]

Don't create an image file. Create a clone to physical drive. Connect to Windows 10 and Bitlocker prompt will pop up asking for the recovery key. Recover files.

But wouldn't the net effect be the same in mounting an image in W10?

 

[labtech]

But wouldn't the net effect be the same in mounting an image in W10?

Could be, I am not sure.

 

[frase]

Ah, you're suggesting I do this the easy way!

Following your suggestion I tried this with the HDD, but the recovery key sent by the customer was apparently the wrong one. I've asked him to see if he can find any other recovery keys for himself or his wife.

Your screwed basically then - well client is.

 

[carmen617]

Check his Microsoft account - his Bitlocker key might be there, or he might have more than one. It's worth a shot. I had a similar situation, the client wasn't even aware Bitlocker was on, and the system was unbootable. But I found the key in his Microsoft account, and was able to boot to the recovery console and unlock the drive there.

 

[Haole Boy]

Update... Client was able to provide bitlockers keys for both his HDD and the SSD (they are different, wasn't expecting that). So, I was able to connect his drives to my bench system and run Fab's against the C:\ drive to grab his data. Also ran Macrium to create an image of his boot drive.

But, when I try to run Macrium vi-Boot, I get an error about an invalid PIN. Is this "normal" when booting a bitlocker protected image in Hyper-V?

Mahalo,

Harry Z